Privacy Policy

1. Controller

The controller responsible for the processing of personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is:

SURFACtoBioTech GmbH
Elly-See-Straße 1
22547 Hamburg
Germany

Represented by: Dr. Jacqueline De Lora, Dr. Martin Schröter
Phone: +49 40 80813182
E-mail: info@surfacto.com

No data protection officer has been appointed.

2. General information on data processing

We take the protection of your personal data seriously. Personal data on this website is only processed to the extent necessary to provide the website, handle contact requests, or arrange appointments.

We process personal data in accordance with the requirements of the General Data Protection Regulation (GDPR) and other applicable data protection provisions. Our website is transmitted encrypted via HTTPS/TLS.

3. Hosting and server log files

Our website is hosted by

Hetzner Online GmbH
Industriestr. 25
91710 Gunzenhausen
Germany

under a Webhosting L package, with the server located in Nuremberg.

The following data is processed when you access our website: browser type and version, operating system used, referrer URL, hostname of the accessing computer, time of the server request, and IP address.

This processing serves the technically reliable provision of the website, ensures IT security, and helps detect and prevent misuse and technical faults. The legal basis is Art. 6(1)(f) GDPR.

Server log files are stored for 7 days and then deleted or anonymised; IP addresses are already recorded in anonymised form within the log file itself. Backups are retained in encrypted form for 14 days. We have a data processing agreement with Hetzner under Art. 28 GDPR.

4. Contact form

Our website offers the possibility of contacting us via a contact form. The form asks for your name, e-mail address and message, and requires your consent before it can be submitted.

For the technical processing of the form we use the service web3forms, operated by Web3Creative (Kerala, India). When you submit the form, your entries are transmitted to web3forms, processed there, and forwarded by e-mail to our Microsoft 365 mailbox. In addition to the form content, web3forms collects technical data such as your IP address, browser type, the website's domain, and the date and time of access, in order to ensure the form's functionality and spam protection.

For spam protection, web3forms uses the sub-processor CleanTalk; in this process, the IP address and e-mail address of the form sender are transmitted to CleanTalk.

As Web3Creative is based outside the EU/EEA, the data transfer takes place on the basis of EU Standard Contractual Clauses in accordance with web3forms' data processing agreement (DPA).

We process your data to handle your enquiry on the basis of your consent (Art. 6(1)(a) GDPR) and our legitimate interest in a functioning, spam-protected contact option (Art. 6(1)(f) GDPR). Your enquiry is retained by us for up to 2 years after it has been finally processed. At web3forms, form data is stored for up to 3 years in accordance with its own privacy policy, unless deleted earlier.

Further information: https://web3forms.com/privacy

5. Appointment booking via Calendly

Our website offers the possibility of booking an appointment via an external link to the service Calendly (Calendly LLC, 271 17th St NW, Atlanta, GA 30363, USA, standard plan).

This is a plain outbound <a> link, not a Calendly pop-up or embedded widget. No connection to Calendly is established unless you click the link.

After clicking, you choose a day and time for a 15-minute video call (Teams meeting) and enter your name, e-mail address and, optionally, a message. Calendly is used exclusively for sales and business appointments.

Further information: https://calendly.com/legal/privacy-notice

This processing is based on our legitimate interest in efficient appointment organisation (Art. 6(1)(f) GDPR) or your consent (Art. 6(1)(a) GDPR). Calendly processes data, among other places, in the USA, safeguarded via the EU-US Data Privacy Framework and EU Standard Contractual Clauses.

6. Cookies and external content

Our website does not use any cookies requiring consent, and does not use any analytics, tracking or marketing services. No external CDNs are used for JavaScript/CSS. Web fonts are hosted locally on our own server. There are no YouTube/Vimeo videos, no maps, no newsletter form, and no other external APIs or services besides those named in this policy (Hetzner, web3forms, CleanTalk, Calendly, Microsoft 365). The LinkedIn link in the footer is a plain external link without an embedded widget.

7. Recipients of personal data

Personal data is, in principle, only made accessible to people within our company who need it to fulfil the purposes described. In addition, the following service providers receive data insofar as this is necessary for them to provide their services:

8. Storage duration

We store personal data, in principle, only for as long as necessary for the respective processing purpose. Specific retention periods: server logs 7 days, backups 14 days, contact enquiries up to 2 years after processing, form data at web3forms up to 3 years.

9. Your rights

Subject to the statutory requirements, you have in particular the right to information, rectification, erasure, restriction of processing, objection, and data portability. Where processing is based on your consent, you may revoke it at any time with effect for the future. To exercise your rights, you can contact us at info@surfacto.com.

10. Right to object to processing based on legitimate interests

Where we process personal data on the basis of Art. 6(1)(f) GDPR, you have the right to object at any time, for reasons arising from your particular situation.

11. Right to lodge a complaint with a supervisory authority

The competent authority is the Hamburg Commissioner for Data Protection and Freedom of Information, Ludwig-Erhard-Str. 22, 20459 Hamburg.

12. Automated decision-making

Does not take place.

13. Currency of this privacy policy

Last updated: August 2026